Description

In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could use the /rest/health endpoint to gather system and cluster telemetry that should be restricted to administrative or support users. The vulnerability is a missing authorization check, where the endpoint does not verify that the caller holds a role permitted to view system health and cluster state. For more information see Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) and Monitor the health of your Splunk SOAR (On-premises) system (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-system-health-and-performance/monitor-the-health-of-your-splunk-soar-on-premises-system) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-19T22:17:21.267Z",
  "pubdate": "2026-08-19T22:17:21.267Z",
  "executiveSummary": "A missing authorization vulnerability exists in Splunk SOAR versions below 8.6.0. The vulnerability resides in the /rest/health endpoint, which fails to properly verify if an authenticated caller possesses the necessary administrative or support roles before granting access to sensitive data. As a result, an authenticated user with no assigned role can successfully query the endpoint to harvest comprehensive system and cluster telemetry data. This unauthorized information disclosure compromises system confidentiality by exposing internal structural metrics and operational states intended strictly for administrative personnel. Exploitation requires valid authentication within the affected system, but requires zero privileges or specific role assignments beyond standard user creation. The risk implications include the potential exposure of sensitive environment details that could aid adversaries in planning subsequent, more targeted attacks against the Splunk SOAR infrastructure.",
  "technicalDetails": "The vulnerability is characterized by a missing authorization check within the access control logic governing the /rest/health endpoint in Splunk SOAR. In affected versions below 8.6.0, the backend routing and request handling mechanisms process incoming HTTP requests to the health monitoring interface without validating the user's role-based access control (RBAC) permissions. Specifically, while authentication is enforced to establish a valid session, the application logic fails to assert whether the authenticated security context holds an administrative or support role permitted to view system health and cluster state.\nThe attack flow begins when an authenticated user possessing no assigned roles and lacking administrative privileges sends an HTTP request directly to the vulnerable /rest/health endpoint. Because the underlying controller or API handler omits the requisite authorization middleware or permission validation function, the application processes the request unconditionally. Upon successful processing, the endpoint compiles and returns detailed system and cluster telemetry data within the HTTP response payload.\nThe affected component is the REST API endpoint handling system health monitoring queries. The vulnerability impacts all Splunk SOAR On-premises deployments running software versions prior to 8.6.0. The attack vector is network-based via the web application interface, requiring the attacker to authenticate to the platform but operating completely without privilege escalation prerequisites regarding role assignments. The post-exploitation impact is limited to unauthorized information disclosure, specifically the leakage of internal telemetry, diagnostic metrics, and cluster configuration states that should remain strictly partitioned from unprivileged users."
}